PT-2009-1082 · Gentoo Linux · Wicd

Tiziano Mueller · Published 2009-02-09 · Updated 2012-07-02 · CVE-2009-0489

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions wicd versions prior to 1.5.9

Description The issue concerns a problem with the wicd package in Gentoo Linux, where exploitation can lead to a breach of protected information confidentiality. This can be exploited locally. The DBus configuration file for Wicd allows arbitrary users to own org.wicd.daemon, enabling local users to receive messages intended for the Wicd daemon, possibly including credentials.

Recommendations For versions prior to 1.5.9, update to version 1.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the DBus configuration file to prevent arbitrary users from owning org.wicd.daemon.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

BDU:2015-09380

CVE-2009-0489

Affected Products

Wicd

References · 8

• https://bdu.fstec.ru/vul/2015-09380 · Security Note
• http://security.gentoo.org/glsa/glsa-200904-12.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0489 · Security Note
• http://sourceforge.net/project/shownotes.php?group_id=194573&release_id=659059 · Note
• http://secunia.com/advisories/33870 · Note
• http://bazaar.launchpad.net/~wicd-devel/wicd/trunk/revision/222 · Note
• http://openwall.com/lists/oss-security/2009/02/06/4 · Note
• http://secunia.com/advisories/34685 · Note